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CLAIMS 

What is claimed is: 



11. A machine readable medium that provides instructions, which when 

2 executed by at least one processor, cause said processor to perform operations 

3 comprising: 

4 encrypting a payload of a data block of a data-stream with at least one key, 

5 before transmitting the data-stream from a first system to a second system; 

6 replacing a portion of said payload with a tag that identifies an at least one 

7 decrypting key to said first system, before said transmitting; and 

8 setting a flag in a header of the data block that indicates that said payload 

9 has said tag, before said transmitting. 

1 2. The medium defined in claim 1 wherein said encrypting includes encrypting 

2 said portion of said payload. 



1 3. The medium defined in claim 1 wherein said tag includes one of: 

2 a data-stream identifier, and 

3 a data-stream identifier and a source, said source characterized by at 

4 least one of a source of said keys, and a source of said keys and a source of 

5 said portion of said payload. 



1 4. The medium defined in claim 1 wherein said operations further include 
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2 receiving a transmission from said second system that includes data 

3 indicating said tag; and 

4 sending one of said keys, and said keys and said portion of said payload, to 

5 said second system based on said transmission. 

1 5. The medium defined in claim 1 wherein said operations further include before 

2 setting said flag and encrypting said payload; said first system 

3 setting said flag in said header, 

4 encrypting said payload, and 

□ 5 receiving a stream of data from a third system wherein said data-stream is 
ffj 6 based on said stream of data. 

~j 1 6. A machine readable medium that provides instructions, which when executed 

m 2 by at least one processor, cause said processor to perform operations comprising: 
m 3 after a fixed-length data block of a data-stream, the data block having both a 

□ 4 payload including an encrypted data portion and at least one tag bits, and a header, 

5 is received by a second system, reading a flag in the header indicating that the data 

6 block has the tag bits; 

7 if the flag indicates that the data block has the tag bits, reading at least one 

8 bit identifying the data-stream in the tag bits; 

9 sending a datum from the second system to a transmitting first system 
10 indicating an identification of the read data-stream based on the at least one bit; 
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1 1 the second system receiving from the first system a definition of a decrypting 

12 keys for the data-stream based on the datum sent from the second system to the 

13 first system; and 

14 decrypting the data block in the second system based on the decrypting keys 

15 received by the second system. 

1 7. The medium defined in claim 6 further including the second system receiving 

2 from the first system the portion of the payload based on the datum sent from the 

3 second system to the first system. 

1 8. The medium defined in claim 6 further including the second system replacing 

2 the at least one tag bits in the payload with the portion of the payload, and if the 

3 portion of the payload is encrypted the decrypting includes decrypting the portion of 

4 the payload. 

1 9. A method comprising: 

2 a sending system replacing a portion of a data block payload with at least one 

3 tag bits that identify an at least one decrypting key; 

4 said sending system setting a flag in a header of said data block that 

5 indicates at least one of said payload is encrypted and said payload includes said 

6 tag; 

7 said sending system encrypting said payload with at least one key; and 

8 said sending system transmitting said data block to a receiving system after 

9 said setting a flag, said encrypting, and said replacing. 
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1 10. The method defined in claim 9 wherein said encrypting includes encrypting 

2 said payload portion. 

1 11. The method defined in claim 9 further including said sending system 

2 transferring a first data characterized by at least one of: 

3 said at least one key to said receiving system; and 

4 said at least one key and said payload portion to said receiving system. 

□ 1 12. The method defined in claim 1 1 wherein said sending system transmitting 

P 2 said first data is based upon said receiving system transmitting to said sending 

-J* 3 system said tag bits. 

CP 

L 1 13. The method defined in claim 12 further including one of: 

2 said sending system transmitting said payload portion to said receiving 

J3 

O 3 system based upon said receiving system transmitting to said sending system said 

4 tag bits; and said receiving system replacing said tag bits with said payload portion 

5 in response to receiving said payload portion from said sending system, and 

6 wherein said encrypting includes encrypting said payload portion, and said 

7 decrypting includes decrypting said payload portion; and 

8 said sending system transmitting said payload portion to said receiving 

9 system based upon said receiving system transmitting to said sending system a first 
10 datum that identifies a data-stream that includes said data block, and said receiving 
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1 1 system replacing said payload portion in response to receiving said payload portion 

12 from said sending system. 

1 14. The method defined in claim 9 wherein said transmitting occurs via a shared 

2 memory unit. 

1 15. The method defined in claim 9 wherein 

2 said sending system and said receiving system are separate physical 

3 devices; 

4 said transmitting of said data block occurs on a first channel; and 

5 transmitting of non-data block data including at least one of said key from 

6 said sending system to said receiving system, said payload portion from said 

7 sending system to said receiving system, and a datum that identifies a data-stream 

8 that includes said data block, occurs on at least one separate second channel. 

1 16. The method defined in claim 9 wherein said tag bits further identify a source 

2 of said keys in said sending system. 

1 17. A method comprising: 

2 a receiving system of an encrpted data block that has a payload and a 

3 header reading a set flag in a header of said data block; 

4 said receiving system reading at least one tag bit in a payload portion of said 

5 data block in response to said reading said set flag; 
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6 said receiving system sending a first datum to a sending system of said 

7 encrypted data block that identifies a data-stream that includes said data block 

8 based on said read tag bits; and 

9 said receiving system decrypting said a payload data of said payload portion 
10 in response to receiving a decryption keys from said sending system. 

1 18. The method defined in claim 17 wherein said tag bits have a source identifier 



2 in said sending system of said decryption keys, and further including said receiving 

3 system sending said source identifier to said sending system in response to said 

4 reading. 

1 19. A data safeguarding system for a data block sent from a first system to a 

2 second system including: 

3 a first system payload replacement circuit that replaces a portion of a payload 

4 of said data block with a tag data that indicates at least one decryption key for said 

5 data block in said first system; 

6 a first system header flag setting circuit that sets a flag in a header of said 

7 data block when said data block includes said tag; 

8 a first system encryption circuit that encrypts said payload with said keys; and 

9 a first system data-stream sending circuit that sends a data-stream that 

1 0 includes said data block to said second system after said header flag setting circuit 

1 1 sets said flag and said encryption circuit encrypts said payload and said payload 

1 2 replacement circuit replaces said portion of a payload. 
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1 20. The system defined in claim 19 wherein said first system encryption circuit 

2 encrypts said portion of said payload. 

1 21 . The system defined in claim 19 further including at least one of 

2 a first system sending circuit that sends said at least one key to said second 

3 system; and 

4 a first system sending circuit that sends said at least one key and said portion 

5 of said payload to said second system. 

□ 1 22. The system defined in claim 21 wherein said first system sending circuit 

Cn 2 sending is based upon said first system receiving from said second system a first 

U] 3 datum that indicates at least one decryption key for said data block in said first 

4 system 



01 

0 



1 23. The system defined in claim 19, further including: 

2 a second system header flag reading circuit that reads said flag in said 

3 header; 

4 a second system tag data reading circuit that reads said tag data if said 

5 second system header flag reading circuit indicates that said flag includes said tag 

6 data; 

7 a second system data sending circuit that sends to said first system a datum 

8 that identifies said data-stream based on said tag data; and 

9 a second system decrypting circuit that decrypts said encrypted block. 
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1 24. The system defined in claim 23 further including a first system key sending 

2 circuit that sends said at least one key to said second system, and wherein said 

3 second system decrypting circuit decrypts said data stream based on said at least 

4 one key. 



1 25. The system defined in claim 23 further including 

2 a first system sending circuit that sends said portion of said payload to said 

3 second system in response to receiving from said second system a datum that 

4 indicates said decryption keys in said first system 

5 said first circuit encryption circuit further encrypts said replaced portion of 

6 said payload; 

7 a second system payload replacement circuit that replaces said received tag 

8 data with said portion of said payload; and 

9 said second system decrypting circuit further decrypts said portion of said 
10 payload. 

1 26. The system defined in claim 19 wherein at least one of: 

2 said sending occurs via a shared memory; and 

3 said first system and said second system are separate physical devices; said 

4 sending of said data-stream occurs on a first channel; and sending non-data-stream 

5 data including at least one of said at least one key, said portion of said payload, and 

6 said data-stream identifier occurs on a second channel. 
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1 27. The system defined in claim 23 wherein said tag data further has an 

2 identifier for accessing a first system unit that can send to said second system said 

3 keys. 



1 28. The system defined in claim 19 further including before said first circuit 

2 header flag setting circuit setting said flag and said first circuit encryption circuit 

3 encrypting said payload, a second circuit receiving circuit that can receive a stream 

4 of data from a third system wherein said data-stream is based on said stream of 

5 data. 



1 29. A system for safeguarding a data block of a data-streamsent from a 

2 first system to a second system comprising: 

3 a second system header flag reading circuit that reads a flag in a header of 

4 said data block; 

5 a second system tag data reading circuit that reads a data-stream identifier in 

6 a tag data of a payload portion of said block if said header flag reading circuit 

7 indicates that said flag includes said tag data; and 

8 a second system data sending circuit that sends to said first system a first 

9 datum that identifies said data-stream based on said data-stream identifier. 



1 30. The system defined in claim 29 further including a second system 

2 decrypting circuit that decrypts said data block. 
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